Subject: overall sasl client-server interaction diagram

From: Jeff Hodges <[email-masked]>
Date: Mon, 03 Aug 1998 14:04:33 -0700

I recently drew up the below diagram for an analysis I did (on Netscape Dir
server's SASL support, (see netscape.server.directory on
secnews.netscape.com)). I'm forwarding it along in case 
you folks think it might be useful in a future revision of the SASL doc. I
think it'd be an improvement to the doc to have this or something like it in
there. 

Jeff

				.
				.
				.
				.
Negotiation of SASL-initiated authentication mechanisms typically consists of
at least two round trips between the client and server..

         client                                    server
           |                                         |
time       | "Open application-protocol connection   |
 |         |  on top of TCP"                         |
 |         +---------------------------------------->|
 |         |                                         |
 V         |                                         |
           | "Connection is opened"                  |
           |<----------------------------------------+
           |                                         |
           |                                         |
           |                                         |
  ---  --- | ----  -----  -----  -----  -----  ----- | ---  ----
    ^      |                                         |
    |      |                                         |
    |      |  "begin authentication, and let's use   |
    |      |   this XXX mechanism"                   |
    |      +---------------------------------------->|
    |      |                                         |
    |      |                                         |
    |      |  "Ok, I'll ~challenge~ you."            |
    |      |<----------------------------------------+
    |      |                                         |
    |      |                                         |
    |      |  "Here's my response, (sometimes)       |
    |      |   containing my credentials             |
    |      |   (depending upon selected mechanism)   |
    |      +---------------------------------------->|
    |      |                                         |
    |      |                                         |
    |                          .
 (SASL Negotiation             . [some number of messages,
  Happens Here)                .  from 0 to N, may be 
    |                          .  exchanged here in order 
    |                          .  to negotiate authentication
    |                          .  and optionally a security
    |                          .  layer.]
    |                          .
    |                          .
    |      |                                         |
    |      |                                         |
    |      |  "Ok, you're auth'd" (plus optionally:  |
    |      |  "and the security layer is set up")    |
    |      |<----------------------------------------+
    V      |                                         |
  ---  --- | ----  -----  -----  -----  -----  ----- | ---  ----
           |                                         |
           |                                         |
           V                                         V
                               .
                               . [client and server begin
                               .  communicating using the 
                               .  protocol, over the
                               .  the optionally secure
                               .  connection]
                               .
                               V

Where:

  XXX = KERBEROS_V4, CRAM_MD5, GSSAPI, SKEY, EXTERNAL, ANONYMOUS

  see: ftp://ftp.isi.edu/in-notes/iana/assignments/sasl-mechanisms